88308b693492b1208dd1a0ffb0c1b216_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

88308b693492b1208dd1a0ffb0c1b216_JaffaCakes118
Size

593KB
MD5

88308b693492b1208dd1a0ffb0c1b216
SHA1

dbc73499985e9f508ce284797ad7f912960fc9df
SHA256

dacc71700e984681f5eca9e52261494cdd05b7a001dcf19b759dc873875929d4
SHA512

1dd12f978207ac0325366e1aadaa0e456e7ebffd3f2f7451e33d956d38d1b22ef9562971b39ae8d5ccee2fa97ca38af14897e1e47cf126a42adcfbede095c502
SSDEEP

12288:eFkWmN7i4XWR81/H8wOJWzGNt2uHP+hiEAKciGb3HkSVJswb9tS2ZIeJwiJH1:Woi4GSFH8wOiGqiPL4ciGbH79blZRJwo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88308b693492b1208dd1a0ffb0c1b216_JaffaCakes118

Files

88308b693492b1208dd1a0ffb0c1b216_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3d05135032f86cc84003861744e4f532

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_SYSTEM

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
CreateFileW
VirtualAlloc
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetCurrentProcess
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW

Sections

.text
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: 1.2MB - Virtual size: 1.2MB

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ